CVE-2026-80605: Linux Kernel HID Use-After-Free Vulnerability

CVE-2026-80605 Overview

CVE-2026-80605 affects the Linux kernel's HID subsystem, specifically the picolcd driver used for PicoLCD USB display devices. The vulnerability resides in the picolcd_send_and_wait() function, where a signed integer loop counter k can overflow. When the loop executes more than INT_MAX iterations, the counter wraps to a negative value, causing the boundary check k < size to evaluate true even when size is 0. This condition leads to a NULL pointer dereference of raw_data. The issue was identified by the Linux Verification Center (linuxtesting.org) using the Svace static analysis tool and has been resolved upstream.

Critical Impact
A theoretical integer overflow in the picolcd HID driver can trigger a NULL pointer dereference in kernel context, resulting in a kernel panic and denial of service on affected Linux systems.

Affected Products

Linux kernel — HID picolcd driver (multiple stable branches, per upstream patch set)
Distributions shipping unpatched Linux kernel builds with the picolcd HID driver enabled
Systems interacting with PicoLCD USB HID devices via the vulnerable code path

Discovery Timeline

Vulnerability found by the Linux Verification Center (linuxtesting.org) using the Svace static analysis tool
2026-08-28 - CVE-2026-80605 published to NVD
2026-08-28 - Last updated in NVD database

Technical Details for CVE-2026-80605

Vulnerability Analysis

The defect is an integer overflow [CWE-190] leading to a NULL pointer dereference [CWE-476] inside the Linux kernel HID picolcd driver. Inside picolcd_send_and_wait(), the loop uses a signed int counter named k to iterate over report data. When the counter increments beyond INT_MAX, it wraps to a negative value under two's complement arithmetic. The negative counter compares as less than the unsigned size operand due to integer promotion rules, keeping the loop alive even when size is 0. The loop body then dereferences raw_data, which is NULL in that branch. The upstream fix changes the type of k to unsigned int, removing the possibility of a signed overflow and eliminating the out-of-bounds access.

Root Cause

The root cause is improper handling of loop bounds in picolcd_send_and_wait(). A signed integer counter combined with a size comparison against an unsigned value allows a negative index to satisfy the continuation condition. This is a classic signed/unsigned comparison bug that becomes exploitable as a NULL pointer dereference when the associated buffer pointer has not been allocated.

Attack Vector

Triggering the flaw requires the vulnerable driver to be loaded and to process a code path that iterates more than INT_MAX times without releasing execution. In practice, this scenario is theoretical on typical hardware but remains a correctness issue in the kernel. Successful exploitation dereferences a NULL pointer in kernel space, causing an oops or panic and resulting in denial of service. The vulnerability does not, based on the upstream description, provide a documented path to privilege escalation or arbitrary code execution.

See the upstream commits for technical implementation details, including Kernel Patch 0021eb0, Kernel Patch 42dc0b7, and Kernel Patch e4edeef.

Detection Methods for CVE-2026-80605

Indicators of Compromise

Unexpected kernel oops or panic messages referencing picolcd_send_and_wait in dmesg or /var/log/kern.log.
NULL pointer dereference stack traces originating from the HID subsystem, specifically the hid-picolcd module.
Sudden system reboots or hangs correlated with attachment or use of a PicoLCD USB HID device.

Detection Strategies

Inventory running kernels and compare against fixed versions listed in the upstream stable tree patches.
Check whether the hid_picolcd module is loaded using lsmod | grep picolcd on Linux hosts.
Review vendor advisories from your Linux distribution for backported fixes referencing CVE-2026-80605.

Monitoring Recommendations

Forward kernel logs to a centralized logging or SIEM platform and alert on BUG: unable to handle or Oops entries involving HID drivers.
Track USB HID device connection events on servers and workstations to identify unexpected PicoLCD device usage.
Continuously monitor kernel package versions across the fleet to confirm patched builds are deployed.

How to Mitigate CVE-2026-80605

Immediate Actions Required

Apply the latest stable Linux kernel updates from your distribution that include the upstream fix for picolcd_send_and_wait().
If patching is not immediately feasible, blacklist the hid_picolcd module on hosts that do not require PicoLCD device support.
Restrict physical access to USB ports on systems where untrusted HID device attachment is a concern.

Patch Information

The upstream fix changes the type of the loop counter k from signed int to unsigned int in picolcd_send_and_wait(), preventing the overflow and the resulting NULL pointer dereference. Fix commits are available across multiple stable branches, including Kernel Patch 48caee2, Kernel Patch a02d5d7, Kernel Patch d354e52, Kernel Patch dc17644, and Kernel Patch ef64970.

Workarounds

Unload the driver at runtime with modprobe -r hid_picolcd on systems that are not actively using a PicoLCD device.
Add hid_picolcd to /etc/modprobe.d/blacklist.conf to prevent automatic loading on reboot.
Enforce USB device policies on endpoints so that only approved HID devices can bind to kernel drivers.

bash

# Blacklist the vulnerable module until the kernel is patched
echo "blacklist hid_picolcd" | sudo tee /etc/modprobe.d/blacklist-picolcd.conf
sudo modprobe -r hid_picolcd
sudo update-initramfs -u